hashit -f hashdeep --mtime format hard to parse when commas present in filename(s)

[clach04]

Files with at least one comma make parsing difficult when mtime is present. This is not an issue with hashdeep/md5deep as there is no mtime option and so processing the first three commas is reasonable.

With hashit, it's difficult to know when mtime has been hit or not. I'm not sure what the best (or least-worse) options/alternatives are.:"

1. Having mtime before filesize would be safer but not compatible with hashdeep.
2. Other idea would be to use quote delimited CSV which seems like a hassle.
3. A crazy idea would be to have mtime in a specially formatted comment on the line below

Demo:

C:\tmp\tempty>dir
 Volume in drive C is Windows
 Volume Serial Number is 76A4-966B

 Directory of C:\tmp\tempty

11/26/2025  11:43 AM    <DIR>          .
11/26/2025  11:29 AM    <DIR>          ..
11/26/2025  11:43 AM                13 comma,file
11/26/2025  11:29 AM                 8 hello
               2 File(s)             21 bytes
               2 Dir(s)  1,409,346,256,896 bytes free

C:\tmp\tempty>C:\programs\md5deep-4.4\hashdeep64.exe  -l -r .
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\tmp\tempty
## C:\tmp\tempty> C:\programs\md5deep-4.4\hashdeep64.exe -l -r .
##
13,33b461ca4c511ed6b6285e6007321bcf,413f863bcb84caf0d83e46ea04d8845e675159c8db908cf3c4fd50069e3264ca,.\comma,file
8,6dd4566eb245627b49f3abb7e4502dd6,f873eef4f852e335da367d76ce7f1973c15b8ffebf532b064df4bc691cd51a87,.\hello

C:\tmp\tempty>hashit -f hashdeep --mtime
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename,mtime
## Invoked from: C:\tmp\tempty
## $ hashit -f hashdeep --mtime
##
13,33b461ca4c511ed6b6285e6007321bcf,413f863bcb84caf0d83e46ea04d8845e675159c8db908cf3c4fd50069e3264ca,comma,file,2025-11-26 11:43:23
8,6dd4566eb245627b49f3abb7e4502dd6,f873eef4f852e335da367d76ce7f1973c15b8ffebf532b064df4bc691cd51a87,hello,2025-11-26 11:29:54

On windows colon ":" is not a valid character in filenames (I can;t recall right this second about other platforms/filesystems) so this might be a possible parsing hint.

[boyter]

When you say parsing, do you mean parsing this output itself? The only reason this output type exists at all is due to wanting to ensure compatibility with hashdeep?

Where I am going with this is, if you have existing tools working with the hashdeep output it should work (I hope!) but if anything new you would use JSON or some other output?

Dealing with commas in filenames... urgh. Always something annoying when it comes to CSV style outputs. Its one of the reasons the other output formats exist.

[boyter]

Interestingly my version of hashdeep when given a file with , in it does not escape it at all,

$ hashdeep test,file
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: /Users/boyter/Documents/projects/hashit
## $ hashdeep test,file
##
0,d41d8cd98f00b204e9800998ecf8427e,e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855,/Users/boyter/Documents/projects/hashit/test,file

$ hashdeep -h
hashdeep version 4.4 by Jesse Kornblum and Simson Garfinkel.

I suspect thats a bug in hashdeep itself, simply becausae the format is not designed for this purpose, which admittedly is a very edge case.

What version of hashdeep are you using that uses the \comma syntax here?

My inclination at this point is to not do anything here, but instead improve the SQLite support for audits, since that would allow hashit to do audits on any amount of content IE scale and ensure these edge cases work. Happy to be convinced otherwise though.